CWE-89Vulnerability type
WordPress SQL Injection vulnerabilities (page 62)
Plugins that build database queries from request data without $wpdb->prepare(). Often unauthenticated and easy to automate.
How to prevent sql injection in WordPress pluginsThe VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Subscribe to Comments
≤2.3.2Update to 2.3.3
- Critical9.8Unauthenticated Arbitrary File Upload
WP-BusinessDirectory – Business directory plugin for WordPress
≤4.0.2No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Testimonials
≤1.4.13No patch available
- Medium5.3Unauthenticated Information Exposure
Document Gallery
≤5.1.1Update to 5.1.2
- Medium5.35.1.1 - Unauthenticated Document Thumbnail Replacement
Document Gallery
4.1 – 5.1.1Update to 5.1.2
- Medium6.45.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Document Gallery
4.0 – 5.1.1Update to 5.1.2
- Medium6.1Reflected Cross-Site Scripting
Document Gallery
≤5.1.1Update to 5.1.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
MLS On The Fly
≤1.8.1.5No patch available
- Critical9.8Unauthenticated Remote Code Execution
AjaxLoadMore Cache
≤3.1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Weaver Xtreme Theme Support
≤7.0.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
IMPress for IDX Broker
≤3.3.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
FV Simpler SEO
≤1.9.7Update to 1.9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Responsive Slider
≤0.1.9No patch available
- High8.1Unauthenticated PHP Object Injection
Quirky - NFT, Token & Artist Marketplace WordPress Theme
≤1.23No patch available
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.25Update to 4.1.26
- Medium4.3Missing Authorization
Download Monitor integration for WooCommerce
≤1.0.3Update to 1.0.4
- Medium5.3Missing Authorization
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
- Medium5.3Unauthenticated Information Exposure
WPGraphQL
≤2.26.0Update to 2.26.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.4Update to 4.9.5
- Medium4.3Missing Authorization
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.1.0Update to 2.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.7.1Update to 4.7.2
- Medium4.9Authenticated (Editor+) SQL Injection
Link Whisper Free
≤0.9.7Update to 0.9.8
- Medium5.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
≤2.4.10Update to 2.4.11
- High7.3Unauthenticated Privilege Escalation
User Rights Access Manager
≤1.1.3No patch available
- Medium5.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.23Update to 2.9.24
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.7Update to 2.12.8
- Medium5.3Missing Authorization
Quick PayPal Payments: Payment Button & Form
≤6.0.3Update to 6.0.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
- Medium5.3Unauthenticated Information Exposure
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.3Update to 2.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.0Update to 3.1.1